Elastalert: Drop match in Enhancement?

Created on 23 Jan 2017  Â·  2Comments  Â·  Source: Yelp/elastalert

In the documentation it says i should call raise DropMatchException() when i want to ignore a match.
So i wrote the following code to drop matches that occurs between 02:30 - 02:45 and 14:30 - 14:45 with the following.

drop_if_in_maintenance_window.py

from elastalert.enhancements import BaseEnhancement
import datetime
import time


def datetime_from_utc_to_local(utc_datetime):
    now_timestamp = time.time()
    offset = datetime.datetime.fromtimestamp(now_timestamp) - datetime.datetime.utcfromtimestamp(now_timestamp)
    return utc_datetime + offset


class DropIfInMaintenanceWindow(BaseEnhancement):
    def process(self, match):
        dateformat = "%Y-%m-%dT%H:%M:%S"
        timestamp = datetime.datetime.strptime(match['@timestamp'][:-5], dateformat)
        timestamp = datetime_from_utc_to_local(timestamp)
        timePart = timestamp.time()
        if timePart >= datetime.time(2, 30) and timePart <= datetime.time(2, 45):
            raise DropMatchException()
        elif timePart >= datetime.time(14, 30) and timePart <= datetime.time(14, 45):
            raise DropMatchException()

but this yields the following error

The rule cpu_alert has raised an uncaught exception.

It has been disabled and will be re-enabled when ElastAlert restarts or if the rule config file has been modified.

Traceback (most recent call last):
  File "/etc/elastalert/elastalert/elastalert.py", line 928, in alert
    return self.send_alert(matches, rule, alert_time=alert_time)
  File "/etc/elastalert/elastalert/elastalert.py", line 980, in send_alert
    enhancement.process(match)
  File "elastalert_modules/drop_if_in_maintenance_window.py", line 21, in process
    raise DropMatchException()
NameError: global name 'DropMatchException' is not defined.

What am i missing?

Most helpful comment

- from elastalert.enhancements import BaseEnhancement
+ from elastalert.enhancements import BaseEnhancement, DropMatchException

All 2 comments

- from elastalert.enhancements import BaseEnhancement
+ from elastalert.enhancements import BaseEnhancement, DropMatchException

@Qmando Thanks!

Was this page helpful?
0 / 5 - 0 ratings